CVE-2026-37216: Ruoyi 4.8.2 XSS Vulnerability in Notice System

Technical summary

The vulnerability exists due to insufficient input sanitization in the /system/notice/add interface of Ruoyi 4.8.2. The application fails to properly encode or filter user-supplied input before storing and rendering notice content to other users. This allows an unauthenticated attacker to inject arbitrary HTML and JavaScript that executes in the context of the victim's browser session (reflected or stored XSS, depending on implementation). The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network-based attack surface, low attack complexity, no privilege requirement, required user interaction, cross-site scope change, low confidentiality and integrity impact, and no availability impact. The root cause is CWE-79: Improper Neutralization of Input During Web Page Generation.

Business impact

An attacker could steal session tokens, authentication cookies, or other sensitive data visible to users accessing the notice system. Secondary impacts include defacement of the notice interface to spread misinformation, phishing redirects embedded in notices, or malware distribution to end-users. For organizations running Ruoyi as a business process management or administrative system, compromise of the notice feature could undermine trust in internal communications and create vectors for lateral movement if users are tricked into further actions.

Affected systems

Ruoyi version 4.8.2 is confirmed vulnerable. Users of earlier or later versions should verify their release notes or consult the vendor advisory; this advisory covers only the tested version. Ruoyi is an open-source rapid development framework commonly used in enterprise management systems in Asia-Pacific regions.

Exploitability

Exploitation is straightforward for an attacker with network access to the Ruoyi instance. No authentication is required to craft a malicious notice. However, the attacker must convince or socially engineer a user to view the notice payload, which is the primary barrier to widespread exploitation. Once a user views the payload, JavaScript executes with the victim's privileges within the application. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active, widespread exploitation at the time of publication.

Remediation

Apply the vendor's security patch for Ruoyi 4.8.2 as soon as it becomes available. In the interim, restrict access to the /system/notice/add interface using authentication controls if feasible, limit notice creation to trusted administrators, and disable or remove the notice feature if it is not essential. Additionally, review and strengthen Content Security Policy (CSP) headers to mitigate XSS execution even if malicious content is injected.

Patch guidance

Monitor Ruoyi's official GitHub repository and security advisories for a patched version. Verify the patch version number and changelog against the vendor's official announcement before deployment. Apply patches to development and testing environments first to confirm compatibility with custom extensions or configurations before rolling out to production. Plan for maintenance windows if the patch requires application restart.

Detection guidance

Monitor application logs for unusual input patterns in requests to /system/notice/add, particularly entries containing HTML tags, JavaScript keywords (script, onerror, onload, etc.), or URL encoding patterns that may indicate XSS payloads. Deploy Web Application Firewall (WAF) rules to block common XSS attack patterns before they reach the application. Enable browser-based XSS detection tools if available in your user base. Review stored notices in the database for suspicious content, especially if created by external or untrusted sources.

Why prioritize this

Although the CVSS score is moderate (6.1), the lack of authentication required, easy attack surface, and potential for data theft or credential harvesting warrant timely patching. The vulnerability does not qualify for CISA's KEV list, suggesting lower real-world exploitation pressure; however, opportunistic attackers may still target exposed Ruoyi instances. Organizations should prioritize based on whether the system is internet-facing and how many users rely on the notice system for trusted communications.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects a network-accessible vulnerability with no privilege requirement, but user interaction is necessary for payload execution. Confidentiality and integrity impacts are low because the attacker gains only limited access to user data visible in the application, not system-level secrets. Availability is unaffected. The cross-site scope change raises the score slightly, as the malicious payload executes within the user's session context. The score is reasonable for an XSS in a notice/bulletin system; critical applications or those handling sensitive data may warrant internal risk adjustments upward.

Frequently asked questions